CVE-2020-16100

Published: Sep 15, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

It is possible for an unauthenticated remote DCOM websocket connection to crash the Command Centre service's DCOM websocket thread due to improper shutdown of closed websocket connections, preventing it from accepting future DCOM websocket (Configuration Client) connections. Affected versions are v8.20 prior to v8.20.1166(MR3), v8.10 prior to v8.10.1211(MR5), v8.00 prior to v8.00.1228(MR6), all versions of 7.90 and earlier.

Affected (6)

Products: Gallagher: Command Centre

Gallagher

1 product

Command Centre

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gallagher Command Centre	From 8.00 to 8.00.1228
Gallagher Command Centre	From 8.10 to 8.10.1211
Gallagher Command Centre	From 8.20 to 8.20.1166
Gallagher Command Centre	Version 8.00.1228
Gallagher Command Centre	Version 8.10.1211
Gallagher Command Centre	Version 8.20.1166

Related CWEs

CWE-404

Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

References (2)

https://security.gallagher.com/Security-Advisories/CVE-2020-16100

Source: disclosures@gallagher.com

Vendor Advisory

https://security.gallagher.com/Security-Advisories/CVE-2020-16100

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.